Re: A permission to re-sign header

Pete Resnick wrote:
> On 4/19/14 10:52 AM, Theodore Ts'o wrote:
>
>> There are mailing lists that want to "fix" broken messages, yes, but
>> if we need to provide end-to-end assurance that the message really
>> came from the originator...
>
> Providing end-to-end assurance that the message really came from the 
> originator is not the stated goal. It would be nice if we could do 
> that, but so far there are operational and deployment problems with 
> accomplishing that. I've got ideas about how we might improve that 
> situation, but they will take much longer to deploy than the things we 
> are talking about here.
>
Is that not a critical goal?  As a sender, I want to make sure that my 
message gets through intact (authentication and integrity).  As a 
recipient, I want to know who authored the message (authentication) and 
that I got what the author sent (integrity).

It strikes me that it's a secondary consideration as to whether the 
author intended to send the message to me - i.e., these cases seem 
important, but secondary:
- someone uses the list as a vector to send unwanted traffic (e.g., 
spam) - that seems to be an issue for authentication of the author, to 
the list server
- the list server sends stuff to me, even if I'm not on it (that's 
simply unsolicited email)
- a malicious actor masquerades as a list server that I'm on - that's 
about the list server authenticating itself to recipients

Ultimately, a sender cares about "protecting their name" (e.g., avoiding 
phishing attacks), and protecting the integrity of what they send.  A 
recipient wants to have some assurance that what they're reading came 
from the avowed sender, and that what you're reading is what they sent.

What that suggests to me is that:

1. The original sending system has to attach some strong cryptography to 
provide both authentication, and integrity.

2. Any intermediate system that munges pieces of the message (changing 
the From address, adding subject tags, adding message headers and 
footers) - has to ALSO add enough information that a recipient can 
recreate the original message, exactly, and validate the original 
signature.  E.g.,
- if a mailing list changes the From: address, it has to put the 
original From: address in a Original-From: header
- if a mailing list adds tags to the subject line, it has to put the 
original Subject: into an Original-Subject header
- if a mailing list adds 5 lines of header and 5 lines of footer to the 
text body, then it needs to add a header indicating as much
- with that information, software at the receiving end can recreate the 
original message, and check its authentication and integrity, and 
mistrust all of the modifications the mailing list added
- the mailing list software can additionally add signatures to 
authenticate itself and provide integrity for the things its changed/added
- of course things get a bit more complicated if MIME, or S/MIME, or 
PGP-enhanced mail, or digests, etc. are added to the mix
- and, of course, this has to be done in a standard way - otherwise 
nobody will be able to write code

Miles Fidelman





-- 
In theory, there is no difference between theory and practice.
In practice, there is.   .... Yogi Berra

_______________________________________________
ietf-822 mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ietf-822